If you would like to update your profile or unsubscribe, please click here.

PLEASE DO NOT REPLY TO THIS MESSAGE.

If you require Technical Support, please check Support Center for information.

Unlike most recent campaigns where the first link in the email is a legitimate but hacked site, this one links directly to a malware server at [donotclick]undering.asia/link.php?login.aspx=[emailaddress]&id=[redacted] with a link that features the email address as part of the URL (presumably to confirm that the address is live). The next step is a redirector link at [donotclick]undering.asia/?affid=00110&promo_type=5&promo_opt=1 which loads a fake anti-virus page, and then it attempts to download a Java exploit from [donotclick]siteswillsrockf.com/?a=YWZmaWQ9MDAxMTA=

undering.asia is hosted on 46.249.42.161, and siteswillsrockf.com on 46.249.42.168. Seeing two malicious sites so closely together indicates that there is a problem with the netblock, so having a closer look at those IPs shows:

The block 46.249.42.0/24 seems to have been suballocated to an unidentified customer of Serverius who have a long history of badness in their IP ranges. Based on this, I would suggest that you add the 46.249.42.0/24 range to your blocklist to prevent other unidentified malicious servers in this block from being a problem.

There are lots of other suspect domains on these two IPs as well:46.249.42.161new-dating-2010.asiabestdating-2010.asiadatingcool-2010.asiagreat-dating2010.asiafreshdating2010.asiamoderndating2010.asianewmeeting2010.asianewdatingafter2010.asiadatingbest2010.asiadatingcool2011.asiadatingbest2011.asiasite-dating-2012.asiagreat-dating-2012.asiabest-dating-2012.asiagreatdating-2012.asianewdatingworld2012.asiasite-dating2012.asiagreat-dating2012.asiabest-dating2012.asiafreshdating2012.asiacooldating2012.asiamoderndating2012.asiagreatdating2012.asiabestdating2012.asialatestdating2012.asianewmeeting2012.asiadatingcool2012.asianewdatingafter2012.asiadatingbest2012.asiadating-2013.asianew-dating2013.asiax-dating2013.asiamy-dating2013.asiamydating2013.asiamatic.asiapuzdoc.asiafeebled.asiacollected.asiahuckleland.asiaquisible.asiajuggle.asiaevasive.asiadishing.asiaskylarking.asiafooling.asiabanning.asiahoning.asiaundering.asiamuleteering.asiagenering.asiaabjecting.asiaconcreting.asiaretorting.asialegmen.asiadisten.asiafirmation.asiaaudration.asiaoutgo.asiairrito.asiagentleship.asiafastender.asiarapier.asiasafekeeper.asiasourer.asiamangles.asiasamenesses.asiadeodorless.asiapulsiveness.asiainitialist.asiamalcy.asiabelably.asiaspacingly.asiacampingly.asiawimpingly.asiaplayingly.asiagrottory.asiatipsy.asiafresh-dating-2010.infonew-dating-2010.infogreatdating-2010.infobestdating-2010.infodatingcool-2010.infodatingbest-2010.infosite-dating2010.infogreat-dating2010.infobest-dating2010.infositedating2010.infofresh-dating-2013.runew-dating-2013.rugreatdating-2013.rubestdating-2013.rudatingcool-2013.rudatingbest-2013.rusite-dating2013.rugreat-dating2013.rubest-dating2013.rusitedating2013.ru